Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
29a748ee by Salvatore Bonaccorso at 2026-10-17T17:19:01+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -137,11 +137,11 @@ CVE-2026-108743 (Improper Neutralization of Special
Elements used in an OS Comma
CVE-2026-108709 (Authentication bypass within in-house network in Apache
Kylin.Impact m ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108374 (ERPNext is a free and open source Enterprise Resource
Planning tool. P ...)
- TODO: check
+ NOT-FOR-US: ERPNext
CVE-2026-108373 (ERPNext is a free and open source Enterprise Resource
Planning tool. P ...)
- TODO: check
+ NOT-FOR-US: ERPNext
CVE-2026-108372 (Open and provider-neutral, LoopX is a lightweight state
kernel and loc ...)
- TODO: check
+ NOT-FOR-US: LoopX
CVE-2026-108123 (The WP Booking System \u2013 Booking Calendar plugin for
WordPress is ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107763 (The Fastcache by Host.it plugin for WordPress is vulnerable
to authori ...)
@@ -780,7 +780,7 @@ CVE-2026-107621 (JPEGParser can enter an infinite loop
while parsing a specially
CVE-2026-107617 (An attacker can use a hard-coded credential to log in to
EseeCloud dev ...)
NOT-FOR-US: EseeCloud
CVE-2026-107564 (An unauthenticated remote attacker may use an allocation of
resources ...)
- TODO: check
+ NOT-FOR-US: gocsaf Development Community csaf_provider
CVE-2026-106705 (ELADMIN (eladmin-mp) up to 2.7 contains an improper access
control vul ...)
NOT-FOR-US: ELADMIN
CVE-2026-106030 (NordVPN for Windows allows local attackers to stop
unprotected Windows ...)
@@ -1960,7 +1960,7 @@ CVE-2026-109383 (undici is an HTTP client library for
Node.js. In versions 4.0.0
- node-undici 8.12.2+dfsg+~cs3.2.3-1
NOTE:
https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
CVE-2026-109131 (The Hub collection module documentation renderer in the
unified Ansibl ...)
- TODO: check
+ NOT-FOR-US: Red Hat Ansible Automation Platform
CVE-2026-108499 (Missing Authorization vulnerability in WebberZone Knowledge
Base knowl ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108498 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -1970,7 +1970,7 @@ CVE-2026-108497 (Improper Neutralization of Special
Elements used in an SQL Comm
CVE-2026-108491 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108334 (A flaw was found in the internal WebAssembly (WASM) shim used
by the K ...)
- TODO: check
+ NOT-FOR-US: Kuadrant operator
CVE-2026-108175 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108116 (In Progress Kendo UI for jQuery prior to v2026.3.1015,
specially craft ...)
@@ -2022,7 +2022,7 @@ CVE-2026-106147 (In Progress\xae Kendo\xae UI for jQuery
releases starting with
CVE-2026-105882 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105660 (Improper Validation of Syntactic Correctness of Input
vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-105474 (A server-side template injection exists in SolusVM 2 up to
version 2.0 ...)
NOT-FOR-US: SolusVM
CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION
contains ...)
@@ -2030,28 +2030,28 @@ CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea"
provided by GEO CORPORATION co
CVE-2026-105065 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104828 (HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to
5.4.0, H ...)
- TODO: check
+ NOT-FOR-US: HtmlUnit Neko
CVE-2026-104827 (react/http is an event-driven, streaming HTTP client and
server implem ...)
- TODO: check
+ NOT-FOR-US: react/http
CVE-2026-104618 (On request the `sdbootutil` script creates a world-readable
debug log ...)
- TODO: check
+ NOT-FOR-US: openSUSE sdbootutil package
CVE-2026-104617 (There are two invocations of `qrencode` to display a QR code
for scann ...)
- TODO: check
+ NOT-FOR-US: openSUSE sdbootutil package
CVE-2026-104586 (AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains
an OS Comm ...)
- TODO: check
+ NOT-FOR-US: AUTOM8N (WHM/cPanel plugin)
CVE-2026-104266 (tinytag is a Python library for reading audio file metadata.
From 2.0. ...)
- python-tinytag 2.3.0-1
NOTE:
https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg
NOTE: https://github.com/tinytag/tinytag/pull/326
NOTE:
https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e
(2.3.0)
CVE-2026-104150 (AdonisJS HTTP Server is a package for handling HTTP requests
in the Ad ...)
- TODO: check
+ NOT-FOR-US: AdonisJS
CVE-2026-104025 (Path Traversal (CWE-22) in the execute_obj function of the
archive obj ...)
TODO: check
CVE-2026-104024 (Incomplete List of Disallowed Inputs (CWE-184) in the
dangerous-extens ...)
TODO: check
CVE-2026-103936 (libp2p is a JavaScript implementation of the libp2p
networking stack. ...)
- TODO: check
+ NOT-FOR-US: Node libp2p
CVE-2026-103509 (P4 Search (formerly Helix Search) returns stored credentials
in cleart ...)
NOT-FOR-US: Perforce
CVE-2026-103508 (P4 Search (formerly Helix Search) allows an authenticated
user holding ...)
@@ -2460,7 +2460,7 @@ CVE-2026-110668 (A weakness has been identified in cemtan
sar2html 4.0.0. Affect
CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket
can forc ...)
NOT-FOR-US: Amazon
CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML
External Entit ...)
- TODO: check
+ NOT-FOR-US: Ellucian WebAdvisor
CVE-2026-109145 (The User Rights Access Manager WordPress plugin through 1.1.3
does not ...)
NOT-FOR-US: WordPress plugin
CVE-2026-108587 (The 10Web Booster \u2013 Website speed optimization, Cache &
Page Spee ...)
@@ -3238,7 +3238,7 @@ CVE-2026-109527 (The Model Context Protocol Python SDK is
the official Python SD
CVE-2026-109506 (Multiple TP-Link Wi-Fi range extenders use a custom,
reversible XOR-an ...)
NOT-FOR-US: TPLink
CVE-2026-109439 (Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware
through 8. ...)
- TODO: check
+ NOT-FOR-US: Lantronix
CVE-2026-109438 (3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923,
contains an ...)
TODO: check
CVE-2026-108484 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -3248,21 +3248,21 @@ CVE-2026-108483 (Improper Neutralization of Input
During Web Page Generation ('C
CVE-2026-108480 (Missing Authorization vulnerability in Skydropx Skydropx
skydropx allo ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108395 (The Model Context Protocol Java SDK is the official Java SDK
for Model ...)
- TODO: check
+ NOT-FOR-US: Model Context Protocol Java SDK
CVE-2026-108390 (Hestia Control Panel is a lightweight and powerful control
panel for t ...)
- TODO: check
+ NOT-FOR-US: Hestia Control Panel
CVE-2026-108291 (Deserialization of Untrusted Data vulnerability in itthinx
Affiliates ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108151 (Improper Control of Generation of Code ('Code Injection')
vulnerabilit ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108072 (Vulnerability due to incorrect permissions in TSplus Remote
Access sha ...)
- TODO: check
+ NOT-FOR-US: TSplus Remote Access
CVE-2026-108071 (Incorrect authentication vulnerability in the TSplus Remote
Access mul ...)
- TODO: check
+ NOT-FOR-US: TSplus Remote Access
CVE-2026-108070 (A vulnerability involving improper access control in the
TSplus Remote ...)
- TODO: check
+ NOT-FOR-US: TSplus Remote Access
CVE-2026-108065 (SQL Injection (CWE-89) in the SOAP GetUser method of the
/preapproval. ...)
- TODO: check
+ NOT-FOR-US: Channel Software WebAlliance eCommerce
CVE-2026-107913
REJECTED
CVE-2026-107870 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
@@ -3300,9 +3300,9 @@ CVE-2026-107421 (Session Fixation vulnerability in
VideoWhisper.com Broadcast Li
CVE-2026-107417 (Missing Authorization vulnerability in Muralidharan Ramasamy
Push Noti ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-107381 (svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0,
Resolver::pr ...)
- TODO: check
+ NOT-FOR-US: darylldoyle svg-sanitizer
CVE-2026-107171 (An Hardcoded Cryptographic Key vulnerability existed in
Trellix Agent ...)
- TODO: check
+ NOT-FOR-US: Trellix
CVE-2026-106599 (Deserialization of Untrusted Data vulnerability in Brainstorm
Force Su ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-106465 (The NetX Secure DTLS server sends a HelloVerifyRequest
carrying a fres ...)
@@ -3312,7 +3312,7 @@ CVE-2026-106464 (`_nx_secure_x509_parse_signature_data`
computes the certificate
CVE-2026-105874 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105659 (Uncontrolled Resource Consumption vulnerability in mtrudel
bandit allo ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-105236 (Improper Certificate Validation vulnerability in the ssl
application i ...)
TODO: check
CVE-2026-105107 (Koha is vulnerable to SQL injection in the Most-circulated
items repor ...)
@@ -3342,7 +3342,7 @@ CVE-2026-104142 (DataEase is an open source data
visualization and analysis tool
CVE-2026-104141 (DataEase is an open source data visualization and analysis
tool. Authe ...)
NOT-FOR-US: DataEase
CVE-2026-104103 (Ludwig is a low-code framework for building custom LLMs,
neural networ ...)
- TODO: check
+ NOT-FOR-US: Ludwig
CVE-2026-104086 (7-Zip before 26.03 contains an uninitialized memory
disclosure vulnera ...)
TODO: check
CVE-2026-103994 (A Heap-based Buffer Overflow vulnerability in theVXLAN
Gateway Daemon( ...)
@@ -3350,23 +3350,23 @@ CVE-2026-103994 (A Heap-based Buffer Overflow
vulnerability in theVXLAN Gateway
CVE-2026-103993 (An Out-of-bounds Write vulnerability in the routing protocol
daemon (r ...)
NOT-FOR-US: Juniper
CVE-2026-103975 (Appium is a cross-platform automation framework for all kinds
of apps, ...)
- TODO: check
+ NOT-FOR-US: Appium
CVE-2026-103974 (lichess.org is the forever free, adless and open source chess
server. ...)
- TODO: check
+ NOT-FOR-US: Lichess Lila
CVE-2026-103946 (An SQL injection vulnerability could allow an authenticated
user to re ...)
NOT-FOR-US: Tenable
CVE-2026-103930 (cpp-httplib is a C++ header-only HTTP/HTTPS library. From
0.29.0 until ...)
TODO: check
CVE-2026-103929 (mise manages dev tools like node, python, cmake, and
terraform. Prior ...)
- TODO: check
+ NOT-FOR-US: mise
CVE-2026-103907 (The JNews - Jeg Elementor Kit plugin for WordPress is
vulnerable to un ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103905 (The authentication middleware of the JTL-Shop administration
backend p ...)
- TODO: check
+ NOT-FOR-US: JTL-Shop
CVE-2026-103904 (The public consent endpoint of JTL-Shop accepts arbitrary
consent name ...)
- TODO: check
+ NOT-FOR-US: JTL-Shop
CVE-2026-103671 (External control of assumed-Immutable web parameter issue
exists in EC ...)
- TODO: check
+ NOT-FOR-US: EC-CUBE
CVE-2026-103415 (When a TLS 1.3 client processes a HelloRetryRequest, it
copies the ser ...)
NOT-FOR-US: Eclipse
CVE-2026-103414 (The GUIX binary resource (theme) loader sizes its arena and
populates ...)
@@ -8505,7 +8505,7 @@ CVE-2026-109152 (A security vulnerability has been
detected in jbardin scp.py up
NOTE: https://github.com/jbardin/scp.py/issues/206
NOTE:
https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d
(v0.16.2)
CVE-2026-109149 (A weakness has been identified in beautifier js-beautify up
to 1.15.1/ ...)
- TODO: check
+ NOT-FOR-US: Node js-beautify
CVE-2026-109144 (A vulnerability was identified in wbond certvalidator up to
0.11.1. Th ...)
TODO: check
CVE-2026-109143 (A vulnerability was determined in calcom cal.com and cal.diy
up to 6.2 ...)
@@ -8603,7 +8603,7 @@ CVE-2026-106171 (A improper neutralization of special
elements used in an os com
CVE-2026-106170 (An Uncaught Exception vulnerability [CWE-248] vulnerability
in Fortine ...)
NOT-FOR-US: Fortinet
CVE-2026-106108 (Quasar Framework is a framework for building high-performance
Vue.js u ...)
- TODO: check
+ NOT-FOR-US: Quasar Framework
CVE-2026-106047 (A Path Traversal vulnerability in the template export
functionality of ...)
NOT-FOR-US: Ivanti
CVE-2026-106043 (A Missing Authentication for Critical Function vulnerability
in Ivanti ...)
@@ -8621,7 +8621,7 @@ CVE-2026-105460 (A flaw was found in BlueZ. An
out-of-bounds read vulnerability
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2545923
NOTE: https://github.com/bluez/bluez/issues/2687
CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker
Hub's accoun ...)
- TODO: check
+ NOT-FOR-US: Docker Hub'saccount-to-organization conversion feature
CVE-2026-104937 (Shopware version 6.7 allows the upload of
attacker\u2011controlled HTM ...)
NOT-FOR-US: Shopware
CVE-2026-104935 (Authentication bypass by spoofing in ICS before version
25.1.3.0 allow ...)
@@ -8666,7 +8666,7 @@ CVE-2026-103965 (An issue in MongoDB Server's aggregation
framework can cause ce
CVE-2026-103937 (Misskey is an open source, federated social media platform.
From 13.0. ...)
NOT-FOR-US: Misskey
CVE-2026-103928 (Metabase is an open source business intelligence and
analytics platfor ...)
- TODO: check
+ NOT-FOR-US: Metabase
CVE-2026-103857 (Adobe Framemaker is affected by an out-of-bounds read
vulnerability th ...)
NOT-FOR-US: Adobe
CVE-2026-103856 (Adobe Framemaker is affected by an out-of-bounds read
vulnerability th ...)
@@ -8684,7 +8684,7 @@ CVE-2026-103417 (Firefox for iOS could autofill saved
credentials into a new pag
CVE-2026-103076 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill
User Reg ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103030 (Dio is a powerful HTTP client for Dart and Flutter. From
1.0.0 until 2 ...)
- TODO: check
+ NOT-FOR-US: Dio
CVE-2026-103028 (SFTPGo is an open source, event-driven file transfer
solution. From 2. ...)
- sftpgo <itp> (bug #1050829)
CVE-2026-102989 (TanStack Router is a client-first, server-capable, fully
type-safe rou ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29a748eedcc833d4e8a48196a89af83dbbe53d72
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29a748eedcc833d4e8a48196a89af83dbbe53d72
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
